Vulnerability Description
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | 0.10.0 |
| Suse | Linux Enterprise | 12.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93191Third Party AdvisoryVDB Entry
- https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bIssue TrackingPatch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/PatchVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93191Third Party AdvisoryVDB Entry
- https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bIssue TrackingPatch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/PatchVendor Advisory
FAQ
What is CVE-2016-7099?
CVE-2016-7099 is a vulnerability with a CVSS score of 5.9 (MEDIUM). The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certific...
How severe is CVE-2016-7099?
CVE-2016-7099 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-7099?
Check the references section above for vendor advisories and patch information. Affected products include: Nodejs Node.Js, Suse Linux Enterprise.